CVE-2025-54314

What it actually does

Thor library method before 1.4.0 constructs shell commands from input that could theoretically allow command injection if attacker-controlled arguments reach it, though the supplier states the affected method only accepts Thor-controlled arguments with no attacker influence possible.

Why it matters to the business

Minimal operational risk given the low CVSS, low EPSS with slight upward trend, disputed nature of the flaw, and 463 days since publication with no known exploitation or ransomware use; widespread use of the Thor library in Ruby ecosystems means organizations should still apply the fix to eliminate any residual uncertainty.

How an attack unfolds

An attacker would need to supply crafted input to the vulnerable Thor method that builds a shell command; however, because the method arguments are controlled internally by Thor itself, no realistic path exists for external control or injection, consistent with the supplier dispute and absence of exploitation in the wild.

How to fix it

Upgrade rails/thor to commit 518ae0f49bb1c3dc2226607c07da74b591759ed0 or later; for Alpaquita packages upgrade libtasn1 to 4.19.0-r1 (v23) or 4.20.0-r0 (stream).

How to confirm the fix worked

Confirm Thor version is at or above the fixed commit; review library usage to ensure no direct calls bypass Thor argument handling; re-scan with dependency tools after upgrade.

Typical attack path

1. Identify a Thor version prior to the fixed commit
2. Attempt to pass attacker-controlled values into the shell-command construction method
3. Observe failure to achieve injection due to internal argument control

How to detect it

Search application and system logs for unexpected shell command execution originating from Thor library calls; review process creation events tied to Thor methods; no confirmed exploitation artifacts exist due to disputed impact and zero KEV entries.

What your security team should do

• Apply the listed fixed versions or commits immediately as a precautionary measure
• Monitor EPSS trend for any further increase despite current low score
• Add Thor to routine dependency scanning to catch future updates